CVE-2025-65879
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled goodsimg parameter, which is directly concatenated with the server's UPLOAD_PATH and passed to File.delete() without validation. A remote authenticated attacker can delete arbitrary files on the server by supplying directory traversal payloads.
Risk Assessment
Risk of data loss or system damage by deleting critical files. The attack requires authentication but can lead to severe disruption.
Recommendation
Update the system to a patched version or apply manual mitigations such as validating the goodsimg parameter and restricting paths to allowed directories.
Other vulnerabilities in Warehouse Management System
Original NVD description (English source)
Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a user-controlled goodsimg parameter, which is directly concatenated with the server's UPLOAD_PATH and passed to File.delete() without validation. A remote authenticated attacker can delete arbitrary files on the server by supplying directory traversal payloads.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS